Kubernetes ServiceAccount RBAC Restriction Tutorial

This tutorial demonstrates how to restrict access to a Kubernetes ServiceAccount within a specific namespace using Role-Based Access Control (RBAC) without impacting existing workloads. We will focus on a practical scenario, demonstrating common issues and resolutions.

Scenario: Restricting Pod Access

A development team deployed a pod named ‘my-app-pod’ that needs to interact with a database service in a separate namespace. Initially, the ‘my-app-pod’ could access the database through a ServiceAccount with broad permissions. We will restrict this access to only allow specific actions on the database service, ensuring a more secure environment.

Example 1: Initial Broad Permissions – The Problem

First, we’ll create a ServiceAccount with default permissions and deploy ‘my-app-pod’. This will demonstrate the initial access problem.

kubectl create serviceaccount my-app-sa --namespace my-app-namespace
kubectl apply -f my-app-pod.yaml  # Assume my-app-pod.yaml exists
kubectl get serviceaccount my-app-sa -o yaml

After running these commands, check the pod logs and see if ‘my-app-pod’ can access the database. This confirms the broad permissions.

kubectl logs my-app-pod -n my-app-namespace

You should observe the pod attempting to connect to the database service, regardless of the database’s security configuration.

Example 2: Creating a Restricted RoleBinding

Now, we’ll create a Role and RoleBinding to limit the ServiceAccount’s access. This Role will grant only ‘get’ access to the database service’s deployment.

apiVersion: rbac.authorization.k8s.io/v1
kind: Role
metadata:
  name: database-reader
  namespace: my-app-namespace
rules:
- apiGroups: ["apps"]
  resources: ["deployments"]
  verbs: ["get"]
---
apiVersion: rbac.authorization.k8s.io/v1
kind: RoleBinding
metadata:
  name: my-app-sa-db-access
  namespace: my-app-namespace
subjects:
- kind: ServiceAccount
  name: my-app-sa
  namespace: my-app-namespace
roleRef:
  kind: Role
  name: database-reader
  apiGroup: rbac.authorization.k8s.io

Apply this RoleBinding:

kubectl apply -f restricted-access.yaml

Check the RBAC configuration:

kubectl get rolebinding my-app-sa-db-access -o yaml

Example 3: Verifying the Restriction and Troubleshooting

Observe that ‘my-app-pod’ can still access the database, but it’s limited to read operations (GET) on the database deployment. If access is denied, carefully examine the events.

kubectl get events -n my-app-namespace --sort-by='.lastTimestamp'

If the application fails to connect, check the following potential issues:

• Incorrect RoleBinding: Ensure the `name` and `namespace` values in the RoleBinding match those of the ServiceAccount and the target namespace.
• Missing API Group: Verify the `apiGroups` in the Role definition match the target resource (e.g., “apps” for deployments).
• Incorrect Verb: The `verbs` list should include the specific action allowed (e.g., [“get”, “list”]).

If an event shows a “Forbidden” error, this confirms the RBAC restriction is working, but the root cause of the access failure lies elsewhere (e.g., the database itself might not be configured for public access).